cake-wallet-web[.]at

This domain, cake-wallet-web.at, is flagged as a crypto_drainer, a threat designed to siphon cryptocurrency from victims by impersonating legitimate wallet services. The site mimics Cake Wallet, a known cryptocurrency payment platform, to deceive users into entering sensitive credentials or authorizing malicious transactions. Analysis indicates the domain is engineered to exploit trust in the Cake Wallet brand, likely targeting users seeking to manage or transfer digital assets securely. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gransy s.r.o., a registrar with a history of hosting malicious domains. It resolves to the IP address 62.60.187.254, located in Russia under AS207713 (GLOBAL INTERNET SOLUTIONS LLC). The domain appears on three security blocklists and is flagged by 17 out of 95 security vendors on VirusTotal. Notably, the site lacks an SSL certificate, further indicating its illegitimate nature. The page title, 'Cake Wallet: Payments Made Easy,' closely mirrors the branding of the legitimate service, increasing the likelihood of successful deception. Users who visited cake-wallet-web.at should immediately revoke any active wallet authorizations linked to the domain and cease all interactions with it. If credentials or private keys were entered, affected wallets must be considered compromised, and funds should be transferred to a new, secure wallet. Monitor transaction histories for unauthorized activity and report the domain to relevant security platforms to aid in broader threat mitigation efforts. Given the high-risk nature of crypto_drainers, proactive measures such as verifying domain authenticity and using hardware wallets for sensitive operations are strongly recommended.